@azure/msal-common 14.15.0 → 15.0.0-alpha.0

package/src/config/ClientConfiguration.ts

@@ -82,11 +82,13 @@ export type CommonClientConfiguration = {
  * - protocolMode                - Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
  * - skipAuthorityMetadataCache  - A flag to choose whether to use or not use the local metadata cache during authority initialization. Defaults to false.
  * - instanceAware               - A flag of whether the STS will send back additional parameters to specify where the tokens should be retrieved from.
+ * - redirectUri                 - The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal.
  * @internal
  */
 export type AuthOptions = {
     clientId: string;
     authority: Authority;
+    redirectUri: string;
     clientCapabilities?: Array<string>;
     azureCloudOptions?: AzureCloudOptions;
     skipAuthorityMetadataCache?: boolean;

package/src/constants/AADServerParamKeys.ts

@@ -56,3 +56,5 @@ export const SID = "sid";
 export const LOGIN_HINT = "login_hint";
 export const DOMAIN_HINT = "domain_hint";
 export const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+export const BROKER_CLIENT_ID = "brk_client_id";
+export const BROKER_REDIRECT_URI = "brk_redirect_uri";

package/src/error/NetworkError.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+
+/**
+ * Represents network related errors
+ */
+export class NetworkError extends AuthError {
+    error: AuthError;
+    httpStatus?: number;
+    responseHeaders?: Record<string, string>;
+
+    constructor(
+        error: AuthError,
+        httpStatus?: number,
+        responseHeaders?: Record<string, string>
+    ) {
+        super(error.errorCode, error.errorMessage, error.subError);
+
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+export function createNetworkError(
+    error: AuthError,
+    httpStatus?: number,
+    responseHeaders?: Record<string, string>
+): NetworkError {
+    return new NetworkError(error, httpStatus, responseHeaders);
+}

package/src/exports-common.ts

@@ -91,11 +91,7 @@ export {
     NetworkRequestOptions,
     StubbedNetworkModule,
 } from "./network/INetworkModule.js";
-export {
-    NetworkManager,
-    NetworkResponse,
-    UrlToHttpRequestOptions,
-} from "./network/NetworkManager.js";
+export { NetworkResponse } from "./network/NetworkResponse.js";
 export { ThrottlingUtils } from "./network/ThrottlingUtils.js";
 export { RequestThumbprint } from "./network/RequestThumbprint.js";
 export { IUri } from "./url/IUri.js";
@@ -140,6 +136,7 @@ export {
     createAuthError,
 } from "./error/AuthError.js";
 export { ServerError } from "./error/ServerError.js";
+export { NetworkError, createNetworkError } from "./error/NetworkError.js";
 export { CacheError, CacheErrorCodes } from "./error/CacheError.js";
 export {
     ClientAuthError,

package/src/network/INetworkModule.ts

@@ -7,7 +7,7 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 
 /**
  * Options allowed by network request APIs.

package/src/network/NetworkResponse.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type NetworkResponse<T> = {
+    headers: Record<string, string>;
+    body: T;
+    status: number;
+};

package/src/network/ThrottlingUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
 import {
     HeaderNames,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.15.0";
+export const version = "15.0.0-alpha.0";

package/src/request/BaseAuthRequest.ts

@@ -29,6 +29,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest.js";
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
  * - popKid                  - Key ID to identify the public key for PoP token request
+ * - embeddedClientId        - Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -50,4 +51,5 @@ export type BaseAuthRequest = {
     storeInCache?: StoreInCache;
     scenarioId?: string;
     popKid?: string;
+    embeddedClientId?: string;
 };

package/src/request/RequestParameterBuilder.ts

@@ -28,13 +28,44 @@ import {
 } from "../config/ClientConfiguration.js";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
 import { ClientInfo } from "../account/ClientInfo.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+
+function instrumentBrokerParams(
+    parameters: Map<string, string>,
+    correlationId?: string,
+    performanceClient?: IPerformanceClient
+) {
+    if (!correlationId) {
+        return;
+    }
+
+    const clientId = parameters.get(AADServerParamKeys.CLIENT_ID);
+    if (clientId && parameters.has(AADServerParamKeys.BROKER_CLIENT_ID)) {
+        performanceClient?.addFields(
+            {
+                embeddedClientId: clientId,
+                embeddedRedirectUri: parameters.get(
+                    AADServerParamKeys.REDIRECT_URI
+                ),
+            },
+            correlationId
+        );
+    }
+}
 
 /** @internal */
 export class RequestParameterBuilder {
     private parameters: Map<string, string>;
+    private readonly performanceClient?: IPerformanceClient;
+    private readonly correlationId?: string;
 
-    constructor() {
+    constructor(
+        correlationId?: string,
+        performanceClient?: IPerformanceClient
+    ) {
         this.parameters = new Map<string, string>();
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
     }
 
     /**
@@ -598,6 +629,19 @@ export class RequestParameterBuilder {
         );
     }
 
+    addBrokerParameters(params: {
+        brokerClientId: string;
+        brokerRedirectUri: string;
+    }): void {
+        const brokerParams: StringDict = {};
+        brokerParams[AADServerParamKeys.BROKER_CLIENT_ID] =
+            params.brokerClientId;
+        brokerParams[AADServerParamKeys.BROKER_REDIRECT_URI] =
+            params.brokerRedirectUri;
+
+        this.addExtraQueryParameters(brokerParams);
+    }
+
     /**
      * Utility to create a URL from the params map
      */
@@ -608,6 +652,12 @@ export class RequestParameterBuilder {
             queryParameterArray.push(`${key}=${value}`);
         });
 
+        instrumentBrokerParams(
+            this.parameters,
+            this.correlationId,
+            this.performanceClient
+        );
+
         return queryParameterArray.join("&");
     }
 }

package/src/response/ResponseHandler.ts

@@ -376,7 +376,7 @@ export class ResponseHandler {
                 cacheRecord.account
             ) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(key);
                 if (!account) {
                     this.logger.warning(
                         "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
@@ -724,7 +724,7 @@ export function buildAccountToCache(
 
     let cachedAccount: AccountEntity | null = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey);
     }
 
     const baseAccount =

package/src/telemetry/performance/PerformanceClient.ts

@@ -198,22 +198,39 @@ export function compactStack(stack: string, stackMaxSize: number): string[] {
     }
 
     const stackArr = stack.split("\n") || [];
-    if (stackArr.length < 2) {
-        return [];
-    }
 
     const res = [];
-    // Get top N stack lines
-    for (
-        // Skip first line as it may contain PII data
-        let ix = Math.max(stackArr.length - stackMaxSize - 1, 1);
-        ix < stackArr.length;
-        ix++
+
+    // Check for a handful of known, common runtime errors and log them (with redaction where applicable).
+    const firstLine = stackArr[0];
+    if (
+        firstLine.startsWith("TypeError: Cannot read property") ||
+        firstLine.startsWith("TypeError: Cannot read properties of") ||
+        firstLine.startsWith("TypeError: Cannot set property") ||
+        firstLine.startsWith("TypeError: Cannot set properties of") ||
+        firstLine.endsWith("is not a function")
     ) {
-        const line = stackArr[ix];
+        // These types of errors are not at risk of leaking PII. They will indicate unavailable APIs
+        res.push(compactStackLine(firstLine));
+    } else if (
+        firstLine.startsWith("SyntaxError") ||
+        firstLine.startsWith("TypeError")
+    ) {
+        // Prevent unintentional leaking of arbitrary info by redacting contents between both single and double quotes
+        res.push(
+            compactStackLine(
+                // Example: SyntaxError: Unexpected token 'e', "test" is not valid JSON -> SyntaxError: Unexpected token <redacted>, <redacted> is not valid JSON
+                firstLine.replace(/['].*[']|["].*["]/g, "<redacted>")
+            )
+        );
+    }
+
+    // Get top N stack lines
+    for (let ix = 1; ix < stackArr.length; ix++) {
         if (res.length >= stackMaxSize) {
             break;
         }
+        const line = stackArr[ix];
         res.push(compactStackLine(line));
     }
     return res;
@@ -630,14 +647,27 @@ export abstract class PerformanceClient implements IPerformanceClient {
             event.correlationId
         );
 
+        if (error) {
+            addError(error, this.logger, rootEvent);
+        }
+
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
             rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
 
-        if (error) {
-            addError(error, this.logger, rootEvent);
+        if (
+            isRoot &&
+            !error &&
+            (rootEvent.errorCode || rootEvent.subErrorCode)
+        ) {
+            this.logger.trace(
+                `PerformanceClient: Remove error and sub-error codes for root event ${event.name} as intermediate error was successfully handled`,
+                event.correlationId
+            );
+            rootEvent.errorCode = undefined;
+            rootEvent.subErrorCode = undefined;
         }
 
         let finalEvent: PerformanceEvent = { ...rootEvent, ...event };

package/src/telemetry/performance/PerformanceEvent.ts

@@ -116,6 +116,7 @@ export const PerformanceEvents = {
     /**
      * Time spent sending/waiting for the response of a request to the token endpoint
      */
+    NetworkClientSendPostRequestAsync: "networkClientSendPostRequestAsync",
     RefreshTokenClientExecutePostToTokenEndpoint:
         "refreshTokenClientExecutePostToTokenEndpoint",
     AuthorizationCodeClientExecutePostToTokenEndpoint:
@@ -342,6 +343,10 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             PerformanceEvents.BaseClientCreateTokenRequestHeaders,
             "BaseClientCreateTReqHead",
         ],
+        [
+            PerformanceEvents.NetworkClientSendPostRequestAsync,
+            "NetClientSendPost",
+        ],
         [
             PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             "RTClientExecPost",
@@ -790,7 +795,14 @@ export type PerformanceEvent = {
     matsSilentStatus?: number;
     matsHttpStatus?: number;
     matsHttpEventCount?: number;
+
+    /**
+     * Http POST metadata
+     */
     httpVerToken?: string;
+    httpStatus?: number;
+    contentTypeHeader?: string;
+    contentLengthHeader?: string;
 
     /**
      * Native broker fields
@@ -834,6 +846,9 @@ export type PerformanceEvent = {
      * @type {string}
      */
     retryError?: string;
+
+    embeddedClientId?: string;
+    embeddedRedirectUri?: string;
 };
 
 export type PerformanceEventContext = {

package/src/utils/Constants.ts

@@ -99,6 +99,7 @@ export const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
  */
 export const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
+    CONTENT_LENGTH: "Content-Length",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",
@@ -112,12 +113,6 @@ export type HeaderNames = (typeof HeaderNames)[keyof typeof HeaderNames];
  * Persistent cache keys MSAL which stay while user is logged in.
  */
 export const PersistentCacheKeys = {
-    ID_TOKEN: "idtoken",
-    CLIENT_INFO: "client.info",
-    ADAL_ID_TOKEN: "adal.idtoken",
-    ERROR: "error",
-    ERROR_DESC: "error.description",
-    ACTIVE_ACCOUNT: "active-account", // Legacy active-account cache key, use new key instead
     ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
 } as const;
 export type PersistentCacheKeys =

package/dist/network/NetworkManager.d.ts

@@ -1,34 +0,0 @@
-import { INetworkModule, NetworkRequestOptions } from "./INetworkModule.js";
-import { RequestThumbprint } from "./RequestThumbprint.js";
-import { CacheManager } from "../cache/CacheManager.js";
-import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
-export type NetworkResponse<T> = {
-    headers: Record<string, string>;
-    body: T;
-    status: number;
-};
-export type UrlToHttpRequestOptions = {
-    protocol: string;
-    hostname: string;
-    hash: string;
-    search: string;
-    pathname: string;
-    path: string;
-    href: string;
-    port?: number;
-    auth?: string;
-};
-/** @internal */
-export declare class NetworkManager {
-    private networkClient;
-    private cacheManager;
-    constructor(networkClient: INetworkModule, cacheManager: CacheManager);
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    sendPostRequest<T extends ServerAuthorizationTokenResponse>(thumbprint: RequestThumbprint, tokenEndpoint: string, options: NetworkRequestOptions): Promise<NetworkResponse<T>>;
-}
-//# sourceMappingURL=NetworkManager.d.ts.map

package/dist/network/NetworkManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"NetworkManager.d.ts","sourceRoot":"","sources":["../../src/network/NetworkManager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAMxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AAEnG,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,gBAAgB;AAChB,qBAAa,cAAc;IACvB,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,YAAY,CAAe;gBAEvB,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY;IAKrE;;;;;OAKG;IACG,eAAe,CAAC,CAAC,SAAS,gCAAgC,EAC5D,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qBAAqB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CAqBjC"}

package/dist/network/NetworkManager.mjs

@@ -1,44 +0,0 @@
-/*! @azure/msal-common v14.15.0 2024-09-20 */
-'use strict';
-import { ThrottlingUtils } from './ThrottlingUtils.mjs';
-import { AuthError } from '../error/AuthError.mjs';
-import { createClientAuthError } from '../error/ClientAuthError.mjs';
-import { networkError } from '../error/ClientAuthErrorCodes.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class NetworkManager {
-    constructor(networkClient, cacheManager) {
-        this.networkClient = networkClient;
-        this.cacheManager = cacheManager;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
-        let response;
-        try {
-            response = await this.networkClient.sendPostRequestAsync(tokenEndpoint, options);
-        }
-        catch (e) {
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
-        }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
-        return response;
-    }
-}
-
-export { NetworkManager };
-//# sourceMappingURL=NetworkManager.mjs.map

package/dist/network/NetworkManager.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"NetworkManager.mjs","sources":["../../src/network/NetworkManager.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;AAAA;;;AAGG;AA+BH;MACa,cAAc,CAAA;IAIvB,WAAY,CAAA,aAA6B,EAAE,YAA0B,EAAA;AACjE,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;AACnC,QAAA,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;KACpC;AAED;;;;;AAKG;AACH,IAAA,MAAM,eAAe,CACjB,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAAA;QAE9B,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAE1D,QAAA,IAAI,QAAQ,CAAC;QACb,IAAI;AACA,YAAA,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CACpD,aAAa,EACb,OAAO,CACV,CAAC;AACL,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,gBAAA,MAAM,CAAC,CAAC;AACX,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,qBAAqB,CAACA,YAAiC,CAAC,CAAC;AAClE,aAAA;AACJ,SAAA;QAED,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAErE,QAAA,OAAO,QAAQ,CAAC;KACnB;AACJ;;;;"}